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Abstract — Is there a meaningful quantum counterpart to public 
communication? We argue that the symmetric-side channel - 
which distributes quantum information symmetrically between 
the receiver and the environment - is a good candidate for 
a notion of public quantum communication in entanglement 
distillation and quantum error correction. 

This connection is partially motivated by [Brandao and Oppen- 
heim, arXiv: 1004.3328 1, where it was found that if a sender would 
like to communicate a secret message to a receiver through an 
insecure quantum channel using a shared quantum state as a key, 
then the insecure quantum channel is only ever used to simulate a 
symmetric-side channel, and can always be replaced by it without 
altering the optimal rate. Here we further show, in complete 
analogy to the role of public classical communication, that 
assistance by a symmetric-side channel makes equal the distillable 
entanglement, the recently-introduced mutual independence, and 
a generalization of the latter, which quantifies the extent to which 
one of the parties can perform quantum privacy amplification. 

Symmetric-side channels, and the closely related erasure 
channel, have been recently harnessed to provide examples of 
superactivation of the quantum channel capacity. Our findings 
give new insight into this non-additivity of the channel capacity 
and its relation to quantum privacy. In particular, we show that 
single-copy superactivation protocols with the erasure channel, 
which encompasses all examples of non-additivity of the quantum 
capacity found to date, can be understood as a conversion of 
mutual independence into distillable entanglement. 

I. Introduction and Results 

Suppose two trusted parties, Alice and Bob, and a malicious 
third party. Eve, share noisy classical correlations given by a 
joint probability distribution Pxyz- These could come e.g. 
from measurements on a quantum state shared by them, or 
from a noisy communication channel, which the eavesdropper 
is trying to tap. If Alice and Bob's distribution contains some 
correlations that are partially unknown to Eve, they can exploit 
this to distill a secret-key (a shared random variable which is 
arbitrarily close to being perfectly correlated between Alice 
and Bob, and completely unknown to Eve). This process 
of obtaining key by previously established correlations is 
known as information-theoretic key agreement lH], ||2l, fS), 
lIU, alluding to the unconditional security of the protocol 
guaranteed by information-theoretic considerations, and not 
conditional on any computational-hardness assumption. 

A key resource in this paradigm is public communication, 
which is conveniently represented by a symmetric broadcast 
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channel which delivers the same information to Bob and Eve 
(or Alice and Eve, if the communication is coming from Bob). 
The notion of public communication is useful first because it 
is a realistic one: in many practical situations the parties have 
access to an authenticated channel which they might freely 
use to communicate, but which might nonetheless be subject to 
eavesdropping. Second, the ability to communicate by a public 
channel turns out to be instrumental in the development of an 
elegant, and tractable, theory of secret-key distillation lIU, ||3|, 
ffl. 

For example, in the one-way or forward public communi- 
cation scenario (which is the one considered throughout the 
rest of this paper), only Alice is able to send public messages 
to Bob and Eve. In this case the distillable secret-key rate of 
the distribution Pxyz (when the parties are given infinitely 
many independent realizations of it) is given by fj), E), iHJ 

C{PxYz)= sup I{V ■.Y\U)~I{V ■.Z\U), (1) 
A'-s-y-i-c/ 

with the conditional mutual information I{V : Y\U) := 
H{VU) + H{YU)-H{VYU) - H{U), the Shannon entropy 
H{X) :— ~'}2,^Px=x^ozPx=x, and the supremum taken 
over the Markov chain X — > y — > J7. 

The formula in Eq. (dJ is so-called single-letter, meaning 
that an optimization over a single copy of the probability 
distribution gives the asymptotic rate. Moreover it is additive, 
i.e. for two probability distributions Pxyz and Qx'Y'Z', 
C{PxYZ®Qx'Y'Z') = C{PxYz) + C{Qx'Y'Z') El. We can 
then say that Eq. (HJ completely characterizes how to optimally 
distill secret-key in the one-way scenario. In contrast, if one 
instead consider the task of distilling a key from common 
randomness without any communication, one finds a much 
more complicated theory, in which even the determination 
of which probability distributions allow the extraction of key 
remains an open problem, let alone the derivation of a tractable 
formula for the distillable secret-key rate. 

In quantum information theory, the paradigm described 
above has two natural analogues, and both have been exten- 
sively analysed fS], 161, Q- The first is to distill a secret-key 
from a tripartite quantum state \'4!abe) shared by Alice, Bob 
and Eve Q. Alice and Bob can perform any operation allowed 
by quantum mechanics on their shares of the state, while (in 
the one-way setting considered here) Alice can communicate 
public classical messages to Bob and Eve. The second is 
entanglement distillation IJS), in which Alice and Bob wish 
to distill Einstein-Podolsky-Rosen (EPR) pairs from a shared 
state ■0AB by local quantum operations and, again, classical 
communication from Alice to Bob (here too, although not 



needed, one can consider that an eavesdropper has a purifica- 
tion of 'ipAB i-e. a pure state ipABE such that ipAB ~ ^Ei'AB, 
and Eve learns all the classical communication that Alice sends 
to Bob). 

In both paradigms, the shared randomness is extended from 
the original classical probability distribution to a quantum 
state. The public communication, however, remains the same; 
even in the quantum case only classical messages can be 
publicly communicated. A natural question then emerges: is 
there a meaningful notion of public quantum communicationl 

A first objection to such a notion comes from the fact that 
quantum information cannot be copied JS), ID and, hence, it 
is problematic to consider a procedure which gives the same 
quantum information to several parties, as in classical public 
communication. A second objection comes from practical con- 
siderations. Both secret-key and entanglement distillation are 
important operational primitives, and the paradigm of quantum 
local operations and public classical communication emerges 
naturally from the resources which are usually available, 
e.g. in a quantum key-distribution set-up. So if we do not 
have an interesting setting where a notion of public quantum 
communication is needed, why bother with such concept? In 
this paper we show that, at least in the one-way setting, both 
objections are not well founded, and that there is room for a 
useful definition of quantum public communication. 

A. Symmetric-side Channels 

In the same way a broadcast channel (which sends the 
same information to the two receivers) is employed as a 
model of a classical public communication channel, we will 
use a quantum symmetric-side channel ifTol as a model of 
quantum public communication. This is the channel which 
maps quantum information symmetrically between the receiver 
and the environment (see section HI] for a precise definition). 

Note that although both the receiver and the eavesdropper 
get the same quantum information in the symmetric-side 
channel, neither of them get the full information originally 
contained in the sender's state, so there is no cloning of 
quantum information. Moreover, if the sender prepares, as the 
input of the symmetric-side channel, a state diagonal in the 
computational basis, then the channel has the same effect as a 
classical symmetric broadcast channel. In this way symmetric- 
side channels can be seen as at least as a natural generalization 
of public communication to quantum states. 

Symmetric-side channels were introduced by Smith, Smolin 
and Winter fTOl with the goal of obtaining a more tractable 
upper bound on the quantum capacity of quantum channels, 
defined as the optimal asymptotic rate at which a quantum 
channel can transmit quantum states faithfully. They analysed 
how assistance by a symmetric-side channel could improve 
the quantum channel capacity and the (one-way) distillable 
entanglement - given by the maximum rate of EPR pairs that 
can be asymptotically extracted from a quantum state by local 
operation and classical communication (from Alice to Bob). 
Remarkably, they found single-letter, additive expressions for 
both assisted capacities; for a bipartite state ipAB with purifi- 
cation \iIjabe), the symmetric-side channel assisted distillable 



entanglement (see section HI] for a formal definition) can be 
manipulated into the form 

Dss{iPab)^ sup ]-{I{a:B\a)-I{a:E\a)), (2) 

using entropic identities and with I{a : B\a) :— S(aa) + 
S{Ba) — S{aBa) — S{a) the conditional mutual information, 
S{a) := —trpalog Pa the von Neumann entropy, and the 
supremum taken over all channels which maps A to aa. This 
expression is a direct quantum generalization of Eq. ([TJ and 
in itself already suggests a formal analogy of distillable entan- 
glement and symmetric-side channels with classical secret-key 
and public communication. 

B. An Operational Motivation 

For an operational motivation for the view of symmetric- 
side channels as public quantum communication, we consider 
the quantum one-time-pad problem analysed and solved in 
[TTl (partially employing the techniques we developed in this 
paper). The setting is as follows. Alice would like to send to 
Bob secret classical or quantum messages, using an ideal, but 
insecure, quantum channel which might be intercepted by an 
eavesdropper, who should not be able to learn anything about 
the message being sent. 

Alice and Bob can make use of the insecure channel for 
secure communication if they share in addition a secret-key. 
Then using their secret correlations Ahce can encode the 
message in a way that (i) Bob can decode it in the case that Eve 
does not intercept the states sent down the insecure quantum 
channel and (ii) Eve cannot distinguish the different messages 
if she intercepts the sent states. We assume that the key is 
given by (several copies of) a quantum state \iPabe) shared 
by Alice, Bob and Eve and the question is to find out what 
is the optimal rate at which the state can be used to encrypt 
classical or quantum messages. 

This problem was first considered in the noiseless case, in 
which Alice and Bob share perfect classical key or EPR pairs 
mi, OS, El- In Ref. QS), in turn, Schumacher and West- 
moreland analysed the case in which the key shared by Alice 
and Bob is a mixed bipartite quantum state ipAB, which is 
not correlated with the eavesdropper. Interestingly, they found 
the optimal rate at which the state can be used as a one-time- 
pad for classical messages to be given by the quantum mutual 
information of V-yis: HA : B)^ = S{A)^+S{B)^-S{AB)^. 

In ifTTl we considered the general case, in which Alice and 
Bob have an arbitrary quantum state, in general correlated with 
Eve. We found that the optimal rate at which the state can be 
used as a one-time-pad for quantum information turns out to 
be given by Eq. (JSji. It is intriguing that it is the symmetric- 
side channel assisted distillable entanglement that appears as 
the optimal rate, even though the problem makes no mention 
in any way of the symmetric-side channel. 

The proof of our result reveals an interesting aspect of 
this task: the insecure quantum channel is only ever used 
to simulate a symmetric-side channel, meaning that in the 
optimal protocol Alice first locally simulates a symmetric-side 
channel, sends through the insecure channel the output part of 



the symmetric-side channel which would go to Bob, and traces 
out the part that would go to Eve. It thus follows that there is 
no difference if Alice and Bob are connected by an insecure 
ideal channel or a symmetric-side channel! 

We can therefore consider the quantum one-time-pad as an 
operational setting where the idea of a symmetric-side channel 
as public quantum communication naturally appears (though 
in an indirect manner). 

C. Superactivation of the Channel Capacity 

There is another line of investigation in which symmetric- 
side channels have been shown very useful: in exhibiting 
examples of non-additivity of the quantum channel capacity 
lfT6l . By the no-cloning theorem fS), ||9l, the symmetric-side 
channel can be seen to have zero quantum capacity. However, 
in lfT6ll Smith and Yard noted that a consequence of Eq. (|2]i 
and the formula of |l6l for the one-way distillable secret-key 
rate {K^) is 



Dss{ikAB) > K^{^Pab)/2, 



(3) 



for all bipartite states ^Jjab- The equation above is striking 
because there are examples of states for which the distillable 
entanglement is zero, but the distillable secret-key is not 
ifTTl . ifTSl . El . In this way, and by considering quantum 
channels which generate such states, we find an example 
of two quantum channels (the symmetric-side channel and 
the other channel which can only produce states with zero 
distillable entanglement, but some with positive distillable key) 
each with zero quantum capacity, but whose tensor product 
has positive quantum capacity. This effect has been termed 
the superactivation of the quantum capacity. 

Equation ^ shows a curious property of the symmetric- 
side channel; it allows the conversion of secret-key into EPR 
pairs (at half the rate). An interesting question, raised already 
in lfT6l and further explored in |[T9l . 1201 . ET\ . asks whether 
there is a more fundamental relation between entanglement 
and secrecy in the presence of symmetric-side channels. For 
instance, might the distillable entanglement and distillable 
secret-key, when assisted by symmetric-side channels, become 
the same? Although it is rather unlikely that this is the case 
(see the remark after the proof of Theorem [8]l, here we will 
show that a relaxed version of the statement is true. That brings 
us to the final concept that we will touch in this work. 

D. Mutual Independence 

The definition of secret-key consists of two requirements: 
(i) Alice and Bob systems should be classical, and perfectly 
correlated and (ii) their state should not be correlated in any 
way with the eavesdropper A relaxed and fully quantum defi- 
nition of private correlations has recently been introduced 1221 . 
in which only the second requirement is kept. Then given a 
bipartite quantum state i/jab, the degree of (potentially noisy) 
private correlations of Alice and Bob, termed mutual indepen- 
dence {Imdi'ipAB)), is given by (half) the mutual information 
of a state extracted by Alice and Bob which is product with 
Eve's state, who is assumed to hold a purifying state for ipAB- 
Their actions are on asymptotically many copies of ipAB and 



one can consider the mutual independence under different 
types of operations e.g. by local operations and classical 
communication. 

An operational significance of this new quantity was given 
in I22I : the sum of quantum communication by Alice and Bob 
required to send their state to a receiver, in the presence of 
free entanglement, is given in terms of the mutual indepen- 
dence rate with no classical communication. Given the view 
of mutual independence as a more relaxed form of private 
correlations than secret-key, we might ask whether a similar 
relation as in Eq. ^ holds. We will show that this is indeed 
the case and that the relation turns out to be actually stronger 
than with secret-key . 

E. Our Results 

Our first contribution is to introduce an even more relaxed 
notion of private correlations, which we call weak mutual 
independence (see section |II]i. Its definition is almost the same 
as that of mutual independence, but here we only require that 
Alice's state is completely decoupled from Eve's. In the setting 
where no classical communication is allowed, the optimal 
protocol is just for Alice to split her system in two and trace 
out one of them, making herself product with Eve and at the 
same time trying to retain as much mutual information as 
possible with Bob. We can then see this quantity as a measure 
of Alice's ability to perform quantum privacy amplification 
against the eavesdropper 

In section |lll] we derive an entropic capacity formula (alas, 
a regularized one) for weak mutual independence in the 
zero and one-way classical communication cases, something 
that remains an open question for mutual independence. Our 
formula turns out to be a direct generalization of both the 
formulae for (one-way) distillable entanglement and distillable 
secret-key of Devetak and Winter |j6| . 

Our main result, presented in section IIVI is the following: 
when assisted by a symmetric-side channel, the weak mutual 
independence rate (Wind.ss), the mutual independence rate 
(^ind.ss), and the distillable entanglement (Dgs) become the 
same, i.e. for every state ipAB 



W,„ 



s{^Ab) = Imd,ss{'ipAB) = Dssi^pAB)- 



(4) 



We note that an analogous equation holds true classically, 
if we replace distillable entanglement by distillable secret-key 
and redefine the two mutual independence rates removing the 
half factor presented in the quantum case. Indeed, the rate of 
weak mutual independence which can be attained classically 
is at least as large as Eq. dU, as one can even get secret-key at 
this rate. But it also holds that the weak mutual independence 
rate cannot be larger than Eq. ^. An optimal protocol for 
weak mutual independence by public communication consists 
of two steps: Alice first applies a transformation to her random 
variable (given by n realizations of the distribution Pxyz) 
X„ — > Vn obtaining Vn and then communicate part of it to 
Bob and Eve, which in turn we can model as an application 
of a map Vn — > Un and the communication of the random 
variable Un- As the protocol extracts mutual independence, 
we must have that, asymptotically, I{Vn : ZnUn) ^^ 0, since 



Alice's final random variable must be decoupled from Eve's. 
Therefore the weak mutual independence rate is bounded as 
follows 

i/(F„ : y„C/„) < -/(y„ : r„C/„) - -/(K : Z„t/„) 
n n n 

= -I{Vn:Yn\Un)--I{Vn:Zr.\Un) 

n n 



< CiPxYz), 



(5) 



where the equality in the second line follows from a simple 
entropic manipulation and the inequality in the last line from 
the additivity of C{Pxyz)- 

Eq. (IDi is also key for our result in ifTTl on the quantum one- 
time-pad. A protocol for sending classical messages would be 
to first distill mutual independence using the insecure channel 
to simulate a symmetric-side channel. One then is in the 
situation considered by Schumacher and Westmoreland ifTsl . 
where initially Alice and Bob are decoupled from Eve, and 
one can then implement their protocol. That the information 
that goes through the insecure channel in the first part of the 
protocol does not leak information to Eve can be seen as 
follows: Alice locally simulates the symmetric side channel 
which she would have used to extract mutual independence, 
and then sends Bob's output to him through the insecure 
quantum channel and traces out the part that would go to Eve. 
If Eve intercepts the state, then because of the symmetry of 
Bob and Eve in the symmetric-side channel, she is just getting 
the information which would have anyway gotten to her in the 
case where there was actually a symmetric side channel, and 
therefore, she has to be decoupled from Alice and Bob's final 
state. 

Finally, Eq. (|4]i is also interesting in the context of su- 
peractivation of the quantum capacity or distillable entangle- 
ment. For one thing, it shows that when looking for more 
superactivation protocols with the symmetric-side channel, one 
can focus on the rather indiscriminate task of making part 
of Alice's state product with the environment. In section |V] 
we show another connection of superactivation with mutual 
independence, which relates the weak mutual independence 
rate without assistance by any side channel, with the maximum 
coherent information (whose regularization gives the distill- 
able entanglement) achievable with the assistance of an erasure 
channel. This is a channel obtained by a particular encoding 
of the symmetric-side channel and is the one actually used in 
all concrete examples of non-additivity found so far lfT6l . lfT9l . 
II20I . II2TI . 1261 . This suggests that weak mutual independence 
might not be increased by symmetric-side channels, which 
would be a considerable improvement of Eq. (|4]i, but which 
we leave as an open problem. 

II. Background and Definitions 

The symmetric-side channel is defined by the property that 
it maps the input state symmetrically to the receiver and the 
environment. For completeness, and in detail, we follow Ref. 
lHO) : consider the symmetric subspace Sd between two d- 
dimensional Hilbert spaces spanned by the basis: 



\{hj)) ■■= 




Let UssM ■■ A -^ BE, with A ^ C''(''+i)/2 and BE ^ Sd, be 
an isometry which maps a basis of the (i((i+ l)/2-dimensional 
Hilbert space into the \{i,j)), in some order. Then the d- 
dimensional symmetric-side channel is defined as 



^ssAp) -^ tr^ Uss,dpUl^^^ 



(7) 



In the (fifty-fifty) erasure channel, with probability half 
the quantum information is sent to the receiver intact, while 
with probability half the information is completely lost to 
the environment and the receiver gets an error flag. Let 
UeM ■■ A ^ BE, with A ?^ C^ and B,E 9i C^+i, be 
the isometry defined as 



UeM\i)^^{\i,e) + \e,i)) 



(8) 



for all i e {0,...,d — 1}, with |e) = \d). Then the erasure 
channel is given by 



Ae,d(p) := tr^ Ue.dpUl^ 



1 1, N/ , 



(9) 



For a channel A{p) := \Xe{U pU^) we define its comple- 
mentary channel as A^(p) := \Xb{U pU^). We say A is anti- 
degradable if there is another quantum operation £ such that 
A = £ o A"^, i.e. Eve can simulate the channel from Alice to 
Bob by applying the operation £ ll23l . Both the symmetric- 
side channel and the erasure channel are examples of anti- 
degradable channels and all such channels have zero quantum 
capacity 1231 . 

Note that one can use a (d + 1) -dimensional symmetric- 
side channel to simulate a d-dimensional erasure channel in 
a very simple way: the sender only have to encode the d- 
dimensional input space into the subspace which gets mapped 
by Ud to the subspace {|(i,j)) : i G {Q,...,d— l},j = d}. 
In fact this is a particular case of a more general property 
of the symmetric-side channel, which can be used to simulate 
any other anti-degradable channel by appropriate encoding and 
decoding operations. 

Theorem 1. For every anti-degradable channel A there is an 
integer d and quantum operations £ and J- such that 



A = £ o Kss,dO T. 



(10) 



(6) 



The proof of the theorem is given in Appendix |A] 

We now turn to the four main quantities which we will be 
concerned with: distillable entanglement |6|, secret key ||6l, 
mutual independence [[22l . and weak mutual independence. 
They are all given by the optimization of a certain cost function 
over a restricted set of operations. Here we are interested in 
the following classes of operations: 

• Local operations (by Alice and Bob), without communi- 
cation. We denote this class by 0. 

• Local operations and one-way classical communication 
from Alice to Bob. The class will be denoted by — >. 

• Local operations and forward communication by (un- 
limited many uses of) an erasure channel. The class is 
denoted by e. 



• Local operations and forward communication by (unlim- 
ited many uses of) a symmetric-side channel. The class 
is denoted by ss. 
In the following let C be one of the class of operations defined 
above. 

Distillable Entanglement: Given a (mixed) bipartite state 
V'AB, a C-protocol for entanglement distillation is formed by 
a sequence of maps A^") from C such that 



lim ||A(")(VfS)~$(M„)||i=0, 



(11) 



where $(!/„) is the A/„ -dimensional maximally entangled 
state given by 



HMn) 



1 



A/„-l A/„-l 

E 

i=0 3=0 



E 



h'i){j,j\ 



(12) 



Definition 2. (distillable entanglement) Given a state tpAB 
and an entanglement distillation C-protocol V = A'"', define 
the rate 

i?(P,^.^B):=liminfi^^i^. 



The C-distillable entanglement of tJjab is given by 



Dcii^As) 



sup R{'P,iPab) 

V 



(13) 



(14) 



Distillable Secret-Key: A C-protocol for secret-key distil- 
lation is a sequence of maps A'"' from C with the property 
that 

A(")®idB(V'|3ij), (15) 



(n) 

Pabe ■- 



with \iPabe) a purification of i/jab, is such that 



lim 



M„-l 



(") 



0. (16) 



Definition 3. (distillable secret-key) Given a state 4'ab, con- 
sider a C-protocol for key distillation V = A^"^ and define the 
rate 

R{V,i'AB) -^ Rimini ^^^. (17) 



(18) 



The C-distillable secret-key of pab is given by 

KcH'ab) :== supi?(P>AB), 
V 

Note that distillation of secret key via public communication 
is completely equivalent to distilling a class of states 7„ called 
pbits via local operations and classical communication iflTl . 
The states 7„ are a broader class of states than pure entangled 
ebits, which allow Alice and Bob to get (almost) perfect 
classical correlations unknown to an adversary, who has a 
purifying system of their state. 



Mutual Independence: Following 11221 . we call a C-protocol 
for extracting mutual independence from ipAB any sequence 
of maps a'"' from the class C with the property that 



^'l^:=A(")®idB(^|S^) 



is such that 



Pabe 



lim IIPaIb 



(«) 
Pab 



'P^E^h=0- 



(19) 



(20) 



Weak Mutual Independence: We define a new quantity, 
which is a weaker notion of mutual independence where we 
only require Alice to be product with Eve. We call a protocol 
for extracting weak mutual independence any sequence of 
maps A("'from C such that 



1™ WPae-Pa ®Pe h =0. 



(21) 



with Pabe defined in Eq. ( fT9] l above. 

Definition 4. (mutual independence and weak mutual indepen- 
dence) Given a state ipAB, consider a C-protocol for extracting 
(weak) mutual independence V = A'"'. Define the rate 



Rir,^AB):=\hiimi^IiA:B 



(22) 



Then we define the C-mutual independence rate of ipAB (^s 

lind.ci^'AB) ■■= SnpR(V,'lpAB), (23) 

V 

while the C-weak mutual independence rate of pab is defined 
as 

Wi„d,c{^AB) :- sup R{r, ^ab), (24) 

V 

III. One formula fits all 

We have seen that mutual independence and its weak variant 
can be seen as extensions of distillable entanglement, or 
distillable secret key, to a setting in which the condition 
that Alice and Bob's systems are perfectly correlated (either 
quantumly as ebits or classically as pbits fTll) is dropped, 
and only the privacy condition that Eve's state is factored 
out is required. In this section we will derive a capacity 
formula for weak mutual independence. This turns out to be 
a generalization of both the formula for one-way distillable 
entanglement and one-way distillable secret-key derived by 
Devetak and Winter ||6l. 

Consider the following classes of completely positive (CP) 
maps: 

• RO {rank-one CP maps): all maps A of the form A((t) = 

• QC {quantum-to-classical maps): all maps A of the form 
A('7) = Ej tr(^,a)|j)0|, with A, > and j:^ A, < id. 

• CP {general CP maps): this is the class formed by all 
CP maps. 

The next theorem shows that (one-way) distillable entangle- 
ment, distillable secret key, and weak mutual independence are 
given by the same quantity optimized over the three classes 
of operations defined above, respectively. 

Theorem 5. For a pure state I^Pabe) ond a class of operations 
C we define 

GciyJAB) ■■= max ]- {I{a : B\a)p ~ I{a : E\a)p) (25) 

p€C Z 



with 



PaBaEa '■ — 



k 



Pk{£k ® ^dBE)ilpABE) ® |fc, k)aa{k, fc|, 



and the maximization taken over all sets of CP maps {£k '■ 
A ^^ a}k contained in the class C and whose elements sum 
up to a quantum operation £ := '^^.Pk^k- Let 

G^iijAB) := lim -Gc(^fS). (26) 



Then 



D^i^PAB)^G^oii^AB), 
K^iijAB) = 2G^cii'AB), 



and 



(27) 
(28) 

(29) 



Proof: Equation ( l28T l follows directly from Ref. 161, while 
Eq. dZTJ i is a simple rearrangement of the formula found in 
Ref. 16]. We only have to note that because each tl'k.ABE '■— 
{£k <8) id_B_E)(V'AB_E) is a pure state, it follows that 

GRoii'AB) (30) 

= lim Vpfc-(/(a : B)^^ - I{a : E)^J 

n— foo ^ — ^ Z 
k 

= lim Vpfe/(a)_B)^, 

n— ^cxD ^ — ^ 
fe 

which is Devetak- Winter formula for the one-way distillable 
entanglement. 

So it remains to prove Eq. (|29] |. Let us start showing the 
achievability of GcpH'ab), which by block coding implies 
that G'^p{ijjab) is achievable as well. The protocol has three 
steps. In the first, Alice applies the operation 



-^c^) = Xl^fe^fc('^)®l^)<^l-^' 



(31) 



to 71 copies of her share of the state, communicates the 
classical information in the register X to Bob and Eve and 
traces out X, obtaining n copies of the state 



iBaEo 



= ^pk{£k <^ ''idBE){lpABE) ® \k, k)aa{k, fc|, (32) 
fe 

where a and a are held by Bob and Eve, respectively. 

In a second step Alice projects her system into its typical 
subspace 1241 . outputing an error flag when the projection fails 
and getting the state (t)2,BaEoi- 

Finally, Alice splits her a„ (which labels the system held 
by Alice) into two registers oi „ and 02, „ of size 



lim — log|a2.; 

71— )-00 Jl 



in such a way that 
lim 



fai „_Ba 



lim — /(a : Eq)„ 

n— i-oo 2n 



5a||l=0. 



(33) 



(34) 



That such a splitting always exists is shown in Lemma |6] As 
Alice's final state is product with Eve's, the protocol extracts 
weak mutual independence. The rate is given by 



lim --/(ai.„ : B) 

n— i-oo Zn 



(35) 



Jim^ ( — /(ai,„a2,„ : B)^ - — /(a2,„ : B\ai^n)q 



where we used the chain rule. From the bound 

/(a2,„:B|ai,„)<21og(|a2,„|) (36) 

and Eq. ( |33] | we then get 

lim --/(ai,„ : B)^ (37) 

> lim (^I{a:B)^~^I{a:E), 

which shows that Wind,-i.(^A_B) > Gcp{i^AB)- 

The converse follows almost directly from the definition 
of Wind.-y- Consider an optimal protocol for extracting weak 
mutual independence as in Def. (|4]i. The optimal 1-way LOCC 
operations A'"^ can be assumed to have the form 



A("Hct) 



^ 9fe,«(Afe,„ (g) ids£;)(cr) ® \k, k)aa{k, k\ (38) 



for a quantum instrument {%,«, A^ „} (i.e. a set of CP maps 
implemented with probability qk,n)- This is so because any 
action of Bob would only decrease his mutual information with 
Alice. Thus the optimal one-way LOCC protocol for Wmd,-> 
consists of Alice applying an instrument to her system and 
communicating which CP map was implemented to Bob and 
Eve. Then 

WmM^ab) (39) 

> G^pOjab), 



lim inf ■ 

Tl—S-OO 2?! 



where the the second equality follows from the fact that Alice's 
state is asymptotically product with Eve's, and the last equality 
comes from the definition of G 



CP- 



Remark: Following the proof of the theorem it is also 
straightforward to derive a formula for the zero-way weak 
mutual independence: 



with 



.(1) 



W^^ad^AB) = lim -M^iidV'^fS) 



1 



(40) 



W>^\{^ab) ■■= max - (/(a : B) - I{a : E)) , (41) 

where the maximization is taken over all isometrics mapping 
A to aa. 

Also along very similar lines to the proof above, we get 
the following generalization of the theorem; for a channel A 
define the quantity 



with 



Ga(V'ab) 



g(i)(a,v 



l.„, l.„, ^"'(''''"•*Tb) ,,,, 



n— ^00 ?Ti— ^00 



AB 



(43) 



sup - [I{a : A{ai)B)^ - I{a : A''{ai)E)^] 



where A'^ is the conjugate channel of A, the optimization is 
taken over all isometrics mapping \tp)ABE to \i/j)aaia2BE, 
and the "A{ai)" in the formula is a shorthand for the state 
obtained by applying A to the ai register of \<j>)aaia2BE- Then 
the distillable entanglement, secret-key capacity, and weak 
mutual independence capacity (zero-way, one-way, assisted by 
erasure channel, by a symmetric-side channel, or by any other 
channel) are all specific cases of this formula for particular 
choices of the channel A. 

The following Lemma in proved in 



Lemma 6. ( H25V Decoupling Lemma) For every bipartite state 
TpAE let ipA^E" be defined as 



l^A'^E^) ■■= Pn.eJ^AEr"/\\Pn.e„\^AEr"\\ 



(44) 



with Pn,e„ the projector onto the En-typical subspace of 
IV'ab)'^"- Then for every sequence {£„} going to zero, there 
is a sequence of isometries Vn '■ A„ '— > ^i,n^2,n such that 



(gin I 



lim \\trA,,„ {Vn^%V^) - T„ ® V: 



with Tn the maximally mixed state in A2,n, ond 
lim ^-^i^^hA = i^A : EU 



0, 



(45) 



(46) 



IV. Assisted Capacities Are Equal 

In this section we prove that under the assistance of an era- 
sure channel or a symmetric-side channel, distillable entangle- 
ment, mutual independence, and weak-mutual independence 
become the same. This result is used in Ref. ifTTl to show 
that these symmetric-side channel assisted capacities give the 
optimal rate at which a quantum state shared by Alice and Bob 
can be used as a one-time-pad to encrypt quantum messages 
which are sent down an insecure quantum channel. 

In the following lemma we give a characterization of states 
with perfect weak mutual independence analogous to the 
characterization of ifTTl for pbits and of ll22l for states with 
perfect mutual independence. We say a state \ipaaBE) has 
perfect weak mutual independence if ipaE = ''Pa® ipE- 

Lemma 7. A state {ipaaBE) hns perfect weak mutual inde- 
pendence if and only if there is an isometry U : aB — > aE 
such that 

U\^aaBE) = \4>aa) ® \Xee) (47) 

Proof: It is clear that any state satisfying Eq. ( |47] | has 
perfect weak mutual independence. To show the converse, we 
note that if ipaE = ipa<E) iJje, there is a purification of ijJaE of 
the form |0aa) ® IXee)- But as \ipaaBE) IS another purification 
oftpaE, by Ulhmann's theorem these two states must be related 
by an isometry acting on the purifying subsystem aB. ■ 



In 11261 an intuitive explanation and generalised protocol 
for Smith and Yard's examples of superactivation lfT6l was 
presented. Given a pbit, one can use the erasure channel to 
send Alice's part of the shield fTT] to Bob. This process then 
generates a state with coherent information equals half the size 
of the key part of the pbit. Then, by considering the process 
in which Alice and Bob first distill pbits from their state and 



then use the erasure channel to convert them into distillable 
entanglement, we get Eq. ([3]). 

A very similar protocol works also for mutual independence 
and weak mutual independence. For the latter, the aB register 
can be seen as the shield part of the state, which protects 
ipa from having correlations with i/je- The amount of key 
is given by half the mutual information of the a and B 
registers. Now suppose Alice sends her share of the shield 
a through an erasure channel to Bob. With probability half. 
Bob gets a. Then he can apply the isometry U of Lemma |7] 
getting S{a) of coherent information with Bob. In the case 
where Bob receives the erasure flag, they will end up with a 
state with coherent information I{a)B). Because Bob knows 
which case happened, the total coherent information is given 
by the average of the two, which is just the weak mutual 
independence of ipaaB, I{o. '■ B)/2. More formally, we have 

Theorem 8. For a bipartite state ipAB, 

Wind.Ei'4'AB) = lindM'pAB) = De{^Ab) (48) 

and, likewise. 



Wi,ul,ss{.'pAB) = Imd,ss{i'AB) = Dss{iPab)- 



(49) 



Proof: It is clear that Wind,EiipAB) > Imd.Eii^AB) > 
De{iPab)- So let us show 



DeI^JAb) > Wind.si^AB)- 



(50) 



Consider the optimal protocol for Wind,E{''pAB)- We can 
assume all the classical communication is made by using the 
erasure channel and that no system is discarded until the very 
end. In the final step the state shared by Alice, Bob and Eve 
is |0"q.b •£;)' ^i'^h the property that 



lim I 

n— ^cxD 



^Blll 



0, 



and 



Wind,E{'pAB) = liminf --/(a : B)^ 

Ti— s-oo Zn 



(51) 



(52) 



Now, suppose that Alice instead of discarding a, sends it down 
the erasure channel. Then the global state becomes 



1 

71 



\€:Bc.:e) ® \e)E' 



1 



'-'a-.B-.Eal 



e B' 



(53) 



Due to the orthogonality of the erasure flag to the rest 
of the state, the coherent information of Alice's and Bob's 
subsystems splits into two as 

\l{a)B) + h{a)Ba) = h{a)B) - h{a)E) (54) 

where we used the identity I{X)Y) — —I{X)Z), valid for 
all pure states \4))xyz- Then, by the hashing inequality 161 , 

DeH^ab) > lim ^I{a)B) - i/(a)S) 

= lim i/(a)S) + ^Sia) 

= lim -I{a : B) 



Wind.Eii^AB), 



(55) 



where the before-last equality follows from the fact that a and 
E are asymptotically product (see Eq. ISTI i. 

The proof for the ss-assisted quantities is completely anal- 
ogous. We only have to use the observation made in section 
im that a symmetric-side channel can be used to simulate an 
erasure channel and apply the reasoning from before. ■ 

Remark 1: We note that we do not know whether the ss- 
assisted distillable secret-key is equal to the other quantities, 
and we conjectured that it is not. Indeed, for an EPR pair all 
the quantities are equal to one. For a pbit iTj, in turn, the 
distillable secret-key is equal to one, while we only have the 
Smith- Yard bound Dss{iPab) > Kss{iPab)/2 [fTSl, which we 
expect to be tight when the shield part of the pbit is composed 
of a separable state. 

Remark 2: The theorem can be applied to any channel 
for which sending the shield part of a state with perfect 
weak mutual independence does not decrease the weak mutual 
independence rate (which is the case for the symmetric-side 
channel and the erasure channel); for any such channel A, we 
have VFa ~ D\. 

v. superactivation and weak mutual 
Independence 

In this section we show that weak mutual independence 
is related to how much the erasure channel can activate the 
distillable entanglement of a given state, at least under a 
restricted class of protocols. Let D^'(V'ab) be the maximum 
coherent information assisted by an erasure channel, defined 
as 



D^E\i^AB) 



max I{a)BB') 



(56) 



with LOabB '■— ^Eii^aaB) and A^; I a ^-> 5 an erasure channel, 
and where the maximization is taken over all isometric split- 
tings of A into aa. We can fully characterize this quantity by 
weak mutual independence rate as follows. 



Proposition 9. 



D 



i''(VMB) = wi:i,{^ab) 



(57) 



max - (/(a : B) - I{a : E)) . 



Proof: A simple calculation gives 



D^e\^ 



AB) = max -I{a)Ba)^,^ 

A'-^aa z 



-A^)B] 



i^aa 



(58) 



Writing the purification of ipaaB as ipaaBE we then find 



D^e\^ab) 



max -I{a)Ba)^ + -I{a)B)^ 

A'^>-aa Z Z 

max -I{a)Ba)^ - -I{a)Ea)^ 

A'-^aa Z Z 

max -I{a)B)^, - -I{a)E)^. 

A'-^aa Z Z 



(59) 



A corollary of the theorem is that there are states for which 
Wlnd,0(V'AB) > K^{iPab)- An example is given by the 



Jamiolkowski state ipAB of the rocket channel of 11211 . where it 
was shown that D^ (Vmb) ^ K^{^1)ab) (with the difference 
being of order of the number of qubits of Alice's state). 

By the same reasoning we also get that there are states 
for which the entanglement measure squashed entanglement 
(Esq) 1271 is much larger than the one-way distillable secret 
key. This comes from the observation that the squashed 
entanglement is an upper bound on Winj g (a fact proven 
implicitly in 1251 and explicitly in ||221 ) and so for the state 
associated with the rocket channel, 

E,q{i'AB) > WmsW'Ab) = D%\i^AB) > K^i^AB). 

(60) 
Since the entanglement of formation Ef can be much greater 
than the squashed entanglement |[28|, we also have that Ej ^ 
Wind is possible. 

VI. Conclusions 

The capacity of a quantum channel is difficult to calculate 
because the best formula we have 1291 , l30l . BTl . the coherent 
information, requires an optimisation over an arbitrarily large 
number of usages of the channel. The symmetric side-channel 
was originally introduced to provide some insight into this 
optimisation - it gives a more tractable upper-bound on the 
capacity of a channel, since when used in conjunction with 
any channel, the combined capacity is single-letter. 

However, here, and in ITTl . we have seen that the 
symmetric-side channel is more than a calculational tool. It 
should be thought of as playing the role of public quantum 
communication, in the same way as public classical commu- 
nication makes the theory of private classical channels more 
elegant and physically natural. The symmetric side-channel is 
conceptually analogous to what one demands of a notion of 
public quantum communication (the receiver and eavesdropper 
both get the same information), and it furthermore makes the 
rates for distilling entanglement equivalent in form to the rates 
of distilling private key using public classical communication. 

The similarity between entanglement and private correla- 
tions was used in constructing the first entanglement distilla- 
tion protocols, and has been used to conjecture new types of 
classical distributions [32 !|. But the analogy between privacy 
and entanglement was first made fully explicit by Collins and 
Popescu l33l and extended in 1341 . The identification of the 
symmetric side-channel with public classical communication 
completes this analogy. 

We have seen that the introduction of public quantum 
communication makes the rate for distilling entanglement have 
a similar form as the rate for distilling classical key. Likewise, 
it allows for correcting noisy correlations, in much the same 
way as in the classical case. This gives further motivation 
for the study of mutual independence, and the weak mutual 
independence introduced here. It also helps us understand 
the phenomena of superactivation, and more generally, non- 
additivity of the channel capacity: the symmetric side-channel 
has no capacity, but it helps correct errors introduced by a 
noisy quantum channel, in much the same way that classical 
communication allows for error reconciliation of private corre- 
lations. A better understanding of weak mutual independence 



thus provides a way to better understand superactivation and 
other forms of non-additivity. 

The mutual independence and the weak mutual indepen- 
dence also help us understand tripartite correlations. It quan- 
tifies how two parties can be correlated (or decoupled) from a 
third party. Mutual independence quantifies how hard it is for 
the global state to be decoupled while still retaining bipartite 
correlations, while the weak mutual independence quantifies 
how hard it is for one party to decouple. To quantify how hard 
it is for each party to individually decouple from the third 
party (while retaining bipartite correlations), one can consider 
the not-so-weak mutual independence, where we demand 
individual privacy but not collective privacy: pae — Pa® Pe 
and pbe — Pb®Pe- How this compares to the original mutual 
independence, enables one to quantify the extent to which a 
third party is correlated to the correlations of two parties. 
It thus enables a better understanding of genuine tripartite 
correlations, a concept which is not well characterised even in 
the classical case. This is reminiscent of attempts to understand 
bipartite correlations (and mutual information) in terms of the 
number of unitaries needed to decouple a state from another 

nm. 

The work here raises a lot of open questions. For example, 
we do not even know if the erasure channel or the symmetric 
side-channel helps in distilling weak mutual independence. For 
that matter, it is possible that even a classical communication 
channel is not helpful. It is possible, that these additional 
channels are only useful for correcting errors (i.e. turning 
mutual independence into EPR pairs). It is also possible 
that the erasure channel is as good as the symmetric-side 
channel for distilling weak mutual-independence, and hence 
for superactivation of private states. Indeed, for general private 
states, the erasure channel appears to provide the optimal 
protocol ||26| . Using the results of Section HI] it would then 
be the optimal anti-degradable channel. 

This work also suggests several questions about categories 
of states and channels. Are there states which have weak 
mutual independence, but from which no private key can be 
distilled? This is related to the problem of bound key 1321 . 
Can we find a characterization of the convex set of states with 
zero Dss^ Can we characterize the class of channels which 
have zero capacity for generating weak mutual independence? 
Can we use the connection between mutual independence and 
channel capacity to find more examples of non-additivity and 
superactivation? 

Finally, although Eq. (|2]i is single-letter, it is of little 
practical use, as it involves an optimization over a system of 
unbounded dimension. Can we upper bound the size of the 
register that goes in the symmetric-side channel in the optimal 
protocol, in analogy to what can be done in the classical case? 
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Appendix 



Let C/a : A M' BE be an isometric extension of A. Since 
A is anti-degradable, there is an isometry V : E '-^ FG such 
that 



IRBFG 



V 



E-^FG 



of/, 



A-^BE\ 



m 



RA 



(61) 



have equal RB and RF reduced states (i.e. (pus — (f>RF) for 
every state \iIjra), where i? is a reference system. 
Define the state 



\'^)rBFGiG2HiH., 
1 



:^^u: 



V2 



^SWAPbe (c/.'^^g?"^ 



G-^GlG■,l 
'ss,\G\ I 



IRBFG 



IRBFG 



® |00)H,ff, 



in; 



H1H2 



with SWAPsi? the unitary which swaps subsystems B and 
F. By construction ^hb = ^{<I>rb + <I>rf) = 4>rb and 
so the states \'^) and \<j>) are related by an isometry from 
FG to FGiG2HiH2- Therefore it suffices to show how 
Alice and Bob can create the state |^) (with Eve holding 
the FG1G2H1H2 registers) by a symmetric-side channel and 
local operations. 

Note that | ^) is permutation symmetric with respect to the 
subsystems a :~ BGiHi and a := FG2H2- Thus there is a 
pre-image state |$)hs such that 



I*; 



RBFG1G2H1H2 



u!.;:IsT\'^)rs- 



(62) 



Proof of Theorem [T] 



Alice and Bob's protocol is the following: Alice transforms 
Ii/jra) into |$)_Rs by applying an operation £ : A ^i' S (which 
always exists because ij-'ji = ^r). Then she sends S through a 
symmetric-side channel producing the state |^), where Alice 
and Eve hold the BGiHi and FG2H2 registers, respectively. 
Finally, Bob applies his local operation F which consists of 
tracing out the register GiHi. 
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